machine_setup/nix/configuration/roles/gpg/default.nix

{
  config,
  lib,
  pkgs,
  ...
}:

{
  imports = [ ];

  # Fetch public keys:
  # gpg --locate-keys tom@fizz.buzz
  #
  # gpg -vvv --auto-key-locate local,wkd --locate-keys tom@fizz.buzz

  programs.gnupg.agent = {
    enable = true;
    enableSSHSupport = true;
  };

  environment.persistence."/persist" = lib.mkIf (!config.me.buildingIso) {
    hideMounts = true;
    users.talexander = {
      directories = [
        {
          directory = ".gnupg";
          user = "talexander";
          group = "talexander";
          mode = "0700";
        } # Local keyring
      ];
    };
  };

}